AI Governance in Two Sentences

I use AI coding agents all day. So does my team. So does almost everyone I talk to. The agent reads the code, writes the fix, runs the tests, installs packages, and pushes the branch. It does all of this as me. It has my SSH keys, my cloud passwords, and every file on my laptop.

People ask me what "AI governance" means for a company like that. My answer has become short.

Governance means two things. You can say what your agents did. And you can stop the things they should not do. Everything else is paperwork about those two sentences.

The two sentences

The first sentence is about the record. If an auditor, a customer, or your own security team asks "what did the agent on that laptop do on Tuesday?", most companies cannot answer. The agent's own chat history is not a record. It is written by the thing you are trying to check. It lives wherever the vendor keeps it. It can be cut short or lost. A real record has to live outside the model.

The second sentence is about the gate. Agents follow instructions they find. A code comment, a README file, a tool description from an MCP server. If any of those say "before you commit, run this command", there is a real chance the agent runs it. This is not a bug in one model. It is what "read the context and act on it" means. OWASP calls this problem Excessive Agency. Their advice is simple: put a check, outside the model, in front of every action.^[1]

Neither of these is a policy question. They are runtime questions. A policy document that says "agents must not read production credentials" does nothing on the laptop where the agent is reading them right now.

Why your current tools don't see it

This surprised me. A company with endpoint protection, a firewall, a log system and a code scanner still has nothing that sees what an agent is about to do.

The endpoint tool sees a trusted user's shell running normal commands. That is what shells do. The firewall sees a web request to a domain it has never heard of. That describes most of the internet. The code scanner sees the code in the repo, not the agent that wrote it and then ran it. Each tool is right about its own layer. The agent works one layer above all of them, inside a session they all trust.

There is a public bug report from a developer whose coding agent ran rm -rf during normal work and emptied the project folder.^[2] The command was written, shown, approved and run in one step. No security tool had a say. From where they sat, nothing unusual happened.

What we built

We started with the gate, because you can install it this afternoon.

AgentShield is a small open-source program. It plugs into the hook that every major coding agent fires before it runs a command or calls a tool. It checks the action through a series of simple, predictable layers. Pattern matching for the known-bad. A real shell parser, so that --recursive and -r and sudo rm all mean the same thing. A check for secret files flowing toward the network. Memory of what the same agent did a moment ago. And a set of checks for tricks like hidden instructions and encoded commands. It answers block, audit or allow, and it names the rule. It runs on the machine, in under thirty milliseconds, and it never calls home. It is open source because a security check you cannot read is a check you are taking on faith.

Then we built the record. AI Agent Lens collects every one of those decisions, from every machine in a company, into one audit trail that cannot be quietly edited. A security team picks which rules to enforce and which to just watch. Each rule maps to the controls in the standards companies are actually checked against: SOC 2, ISO 27001, ISO 42001, the EU AI Act, MITRE ATLAS, OWASP, GDPR and HIPAA. When the auditor asks how you govern your agents, you hand over what actually happened, not a document about what you meant to happen.

What it does not do

Three things, because I would rather you heard them from me.

It never runs anything. The agent asks "may I?", we answer, and the agent's own runtime does the rest.

It never sends your commands anywhere. Everything is checked locally. There is no telemetry.

It will not catch everything. It is careful analysis, not magic. When we find a way past our own product, we publish it, along with the fix. Three lines of bash got past six layers is a good example. Knowing where the edges are is part of the control.

Our place in this

We are not trying to be the model. Anthropic, OpenAI and Google will keep making agents smarter, and each of them will keep improving safety inside their own agent. That is good. But every company will run agents from more than one vendor, and the check that governs all of them cannot belong to one of them. Someone independent has to sit between the agent and the machine, on the customer's side, and keep the record.

That is our place. A small, open, readable gate in front of every agent. One honest record behind it. Evidence for the auditor instead of intentions.

What it looks like in practice

Install the gate on every machine that runs an agent, in watch-only mode. Nothing is blocked. For two weeks, just look at the record. What did the agents do? What would have been blocked? Which rules fire on real work, and which never fire? Those two weeks tell you which of your policies are already true and which are wishes.

Then turn on enforcement for the handful of rules that matter. Credential reads. Piping a download straight into a shell. Sending files to the outside. Agents keep working. Developers do not notice, because good commands were never the problem.

From then on, the compliance conversation is short. Which controls were exercised by real agent activity this quarter? Here is the list. Which agent tried to read the production credentials, and what happened? Here is the event and the block. Show me your human oversight under Article 14 of the EU AI Act.^[3] Here is the review queue.

That is governance. Two sentences, running at the speed of the agent, producing evidence instead of promises.

If you run agents and want to see your own record, install the gate and leave it in watch mode for a week. Then write to me. I want to know what you found.